What you'll see: messages to some domains stay in the delivery queue and are retried later, even though your DNS server is working. If that goes on long enough, the sender gets a bounce. We've seen it with paypal.com, seznam.cz, kpnmail.nl and xs4all.nl, and it isn't limited to those. With application logging on, the log says the DNSSEC lookup of the TLSA records "could not be completed".

The cause: a bug in our DNSSEC checking. Some signed domains prove that a name doesn't exist in a valid way that our code misreads as incomplete. The server then can't tell whether the domain requires DANE, so it holds the message rather than risk sending it insecurely.

What to do: the fix is in testing for 6.3.9, which has no date yet. If you have mail stuck now:

1. In the Control Panel, open Transport security, then the Encryption tab, and find DANE & DNSSEC.
2. Untick "Honour recipient DANE/TLSA records when sending", then choose Save changes.
3. Open the delivery queue and choose Deliver all now.

This turns off DANE checks for all your outgoing mail, so tick it again once you're on 6.3.9. Use the Control Panel rather than editing hMailServer.ini, because an ini edit is hard to undo. If you run on Linux, which has no Control Panel, post here and we'll help you with this step.

If nearly all your outgoing mail is stuck, the cause is more likely a DNS server or firewall that drops DNSSEC data or blocks DNS over TCP. The same steps get mail moving while you look at that.

If you're seeing something else, please post the log line here with addresses and passwords removed.